Compare commits
| Author | SHA1 | Date | |
|---|---|---|---|
 sysadmin
|
996e7094fe | ||
  jcwalker3andClaude Opus 4.8
|
ab33337a94 |
@@ -1,824 +0,0 @@
|
||||
"""Sanctioned author issue worktree bootstrap for allocated issues (#850).
|
||||
|
||||
Bootstraps an allocated author branch, canonical worktree under ``branches/``,
|
||||
worktree registration, issue lock, and lease/assignment binding without
|
||||
caller-side Git, Bash, or helper scripts.
|
||||
|
||||
Features:
|
||||
1. Durable phase journal with read-after-write evidence for every phase.
|
||||
2. Idempotent replay handling via idempotency keys.
|
||||
3. Authoritative expected-base / concurrency-pin validation.
|
||||
4. Typed stale-pin refusal without silent rebasing or repointing.
|
||||
5. Canonical branches-root enforcement (path MUST be inside branches/).
|
||||
6. Preexisting work preservation (dirty tracked/untracked check, foreign ownership refusal).
|
||||
7. Compensating recovery limited strictly to artifacts created by this transition.
|
||||
8. Satisfiable exact_next_action for MCP scheduled workers.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import os
|
||||
import shutil
|
||||
import subprocess
|
||||
from typing import Any, Mapping
|
||||
|
||||
import author_mutation_worktree
|
||||
import issue_lock_store
|
||||
import issue_lock_worktree
|
||||
import lease_lifecycle
|
||||
from reviewer_worktree import parse_dirty_tracked_files
|
||||
import task_capability_map
|
||||
|
||||
BOOTSTRAP_TASKS = frozenset(
|
||||
{
|
||||
"bootstrap_author_issue_worktree",
|
||||
"gitea_bootstrap_author_issue_worktree",
|
||||
}
|
||||
)
|
||||
|
||||
PHASE_1_REQUEST_ACCEPTED = "1_request_accepted"
|
||||
PHASE_2_BRANCH_CONFIRMED = "2_branch_confirmed"
|
||||
PHASE_3_PATH_RESERVED = "3_path_reserved"
|
||||
PHASE_4_WORKTREE_CONFIRMED = "4_worktree_confirmed"
|
||||
PHASE_5_REGISTRATION_VERIFIED = "5_registration_verified"
|
||||
PHASE_6_STATE_ESTABLISHED = "6_state_established"
|
||||
PHASE_7_TRANSITION_COMPLETED = "7_transition_completed"
|
||||
PHASE_COMPENSATING_RECOVERY = "compensating_recovery"
|
||||
|
||||
JOURNAL_DIR_NAME = "bootstrap-journals"
|
||||
|
||||
|
||||
def is_author_issue_bootstrap_task(task: str | None) -> bool:
|
||||
"""True when *task* is the author issue worktree bootstrap task."""
|
||||
return (task or "").strip() in BOOTSTRAP_TASKS
|
||||
|
||||
|
||||
def get_journal_dir(override: str | None = None) -> str:
|
||||
"""Return the root directory for durable bootstrap phase journals."""
|
||||
if override:
|
||||
path = override
|
||||
elif os.environ.get("GITEA_BOOTSTRAP_JOURNAL_DIR"):
|
||||
path = os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"]
|
||||
else:
|
||||
cache_dir = os.path.expanduser("~/.cache/gitea-tools")
|
||||
path = os.path.join(cache_dir, JOURNAL_DIR_NAME)
|
||||
os.makedirs(path, exist_ok=True)
|
||||
return path
|
||||
|
||||
|
||||
def _journal_file_path(idempotency_key: str, journal_dir: str | None = None) -> str:
|
||||
safe_key = "".join(
|
||||
c if c.isalnum() or c in ("-", "_", ".") else "_"
|
||||
for c in idempotency_key
|
||||
)
|
||||
return os.path.join(get_journal_dir(journal_dir), f"{safe_key}.json")
|
||||
|
||||
|
||||
def load_phase_journal(
|
||||
idempotency_key: str, journal_dir: str | None = None
|
||||
) -> dict[str, Any] | None:
|
||||
"""Load a durable phase journal if it exists."""
|
||||
path = _journal_file_path(idempotency_key, journal_dir=journal_dir)
|
||||
if not os.path.isfile(path):
|
||||
return None
|
||||
try:
|
||||
with open(path, "r", encoding="utf-8") as f:
|
||||
return json.load(f)
|
||||
except Exception:
|
||||
return None
|
||||
|
||||
|
||||
def save_phase_journal(
|
||||
journal: dict[str, Any], journal_dir: str | None = None
|
||||
) -> None:
|
||||
"""Persist a durable phase journal with write-through file sync."""
|
||||
key = journal["idempotency_key"]
|
||||
path = _journal_file_path(key, journal_dir=journal_dir)
|
||||
tmp_path = f"{path}.tmp.{os.getpid()}"
|
||||
with open(tmp_path, "w", encoding="utf-8") as f:
|
||||
json.dump(journal, f, indent=2, sort_keys=True)
|
||||
os.replace(tmp_path, path)
|
||||
|
||||
|
||||
def derive_default_idempotency_key(
|
||||
remote: str,
|
||||
org: str | None,
|
||||
repo: str | None,
|
||||
issue_number: int,
|
||||
assignment_id: str | None = None,
|
||||
lease_id: str | None = None,
|
||||
) -> str:
|
||||
parts = [
|
||||
"bootstrap",
|
||||
(remote or "prgs").strip(),
|
||||
(org or "Scaled-Tech-Consulting").strip(),
|
||||
(repo or "Gitea-Tools").strip(),
|
||||
f"issue-{issue_number}",
|
||||
]
|
||||
if assignment_id:
|
||||
parts.append(assignment_id.strip())
|
||||
if lease_id:
|
||||
parts.append(lease_id.strip())
|
||||
return ":".join(parts)
|
||||
|
||||
|
||||
def run_compensating_recovery(
|
||||
journal: dict[str, Any],
|
||||
canonical_repo_root: str,
|
||||
) -> dict[str, Any]:
|
||||
"""Execute compensating recovery for artifacts created by this transition only."""
|
||||
artifacts = journal.get("artifacts_created") or {}
|
||||
rolled_back: list[str] = []
|
||||
worktree_path = journal.get("worktree_path")
|
||||
branch_name = journal.get("branch_name")
|
||||
|
||||
if (
|
||||
artifacts.get("worktree_registered") or artifacts.get("worktree_dir_created")
|
||||
) and worktree_path:
|
||||
if os.path.exists(worktree_path):
|
||||
try:
|
||||
subprocess.run(
|
||||
[
|
||||
"git",
|
||||
"-C",
|
||||
canonical_repo_root,
|
||||
"worktree",
|
||||
"remove",
|
||||
"--force",
|
||||
worktree_path,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
except Exception:
|
||||
pass
|
||||
if os.path.exists(worktree_path):
|
||||
shutil.rmtree(worktree_path, ignore_errors=True)
|
||||
try:
|
||||
subprocess.run(
|
||||
["git", "-C", canonical_repo_root, "worktree", "prune"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
except Exception:
|
||||
pass
|
||||
rolled_back.append(f"worktree_path:{worktree_path}")
|
||||
|
||||
if artifacts.get("branch_created") and branch_name:
|
||||
try:
|
||||
res = subprocess.run(
|
||||
[
|
||||
"git",
|
||||
"-C",
|
||||
canonical_repo_root,
|
||||
"rev-parse",
|
||||
"--verify",
|
||||
branch_name,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
if res.returncode == 0:
|
||||
subprocess.run(
|
||||
[
|
||||
"git",
|
||||
"-C",
|
||||
canonical_repo_root,
|
||||
"branch",
|
||||
"-D",
|
||||
branch_name,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
rolled_back.append(f"branch:{branch_name}")
|
||||
except Exception:
|
||||
pass
|
||||
|
||||
recovery_info = {
|
||||
"executed": True,
|
||||
"rolled_back": rolled_back,
|
||||
"reason": journal.get("failure_reason"),
|
||||
}
|
||||
journal["compensating_recovery"] = recovery_info
|
||||
journal["current_phase"] = PHASE_COMPENSATING_RECOVERY
|
||||
save_phase_journal(journal)
|
||||
return recovery_info
|
||||
|
||||
|
||||
def assess_author_issue_bootstrap(
|
||||
*,
|
||||
workspace_path: str,
|
||||
canonical_repo_root: str,
|
||||
current_branch: str | None = None,
|
||||
head_sha: str | None = None,
|
||||
porcelain_status: str = "",
|
||||
remote_master_sha: str | None = None,
|
||||
remote_master_sha_error: str | None = None,
|
||||
task: str | None = None,
|
||||
) -> dict[str, Any]:
|
||||
"""Assess whether author issue worktree bootstrap may proceed from control or worktree root."""
|
||||
root = os.path.realpath(canonical_repo_root or "")
|
||||
workspace = os.path.realpath(workspace_path or root or ".")
|
||||
branch = (current_branch or "").strip()
|
||||
dirty = parse_dirty_tracked_files(porcelain_status or "")
|
||||
under_branches = (
|
||||
author_mutation_worktree.is_path_under_branches(workspace, root)
|
||||
if root
|
||||
else False
|
||||
)
|
||||
|
||||
if not is_author_issue_bootstrap_task(task):
|
||||
return {
|
||||
"not_applicable": True,
|
||||
"allowed": False,
|
||||
"block": False,
|
||||
"proven": False,
|
||||
"reasons": ["task is not author_issue_bootstrap"],
|
||||
}
|
||||
|
||||
if under_branches:
|
||||
return {
|
||||
"not_applicable": False,
|
||||
"allowed": True,
|
||||
"block": False,
|
||||
"proven": True,
|
||||
"bootstrap_path": "existing_branches_worktree",
|
||||
"reasons": [
|
||||
"workspace is already a registered worktree under branches/"
|
||||
],
|
||||
}
|
||||
|
||||
reasons: list[str] = []
|
||||
if workspace != root:
|
||||
reasons.append(
|
||||
"bootstrap requires workspace to be canonical control checkout or branches/ worktree"
|
||||
)
|
||||
if branch not in author_mutation_worktree.BASE_BRANCHES:
|
||||
reasons.append(
|
||||
f"control checkout branch '{branch}' is not an accepted base branch "
|
||||
f"({', '.join(sorted(author_mutation_worktree.BASE_BRANCHES))})"
|
||||
)
|
||||
if dirty:
|
||||
reasons.append(
|
||||
f"control checkout has tracked local edits: {', '.join(dirty[:5])}"
|
||||
)
|
||||
|
||||
if remote_master_sha_error:
|
||||
reasons.append(
|
||||
f"could not verify live master tip: {remote_master_sha_error}"
|
||||
)
|
||||
elif remote_master_sha and head_sha:
|
||||
h = head_sha.strip().lower()
|
||||
rm = remote_master_sha.strip().lower()
|
||||
if h != rm:
|
||||
reasons.append(
|
||||
f"control checkout HEAD ({h[:12]}) != live master tip ({rm[:12]})"
|
||||
)
|
||||
|
||||
if reasons:
|
||||
return {
|
||||
"not_applicable": False,
|
||||
"allowed": False,
|
||||
"block": True,
|
||||
"proven": False,
|
||||
"reasons": reasons,
|
||||
}
|
||||
|
||||
return {
|
||||
"not_applicable": False,
|
||||
"allowed": True,
|
||||
"block": False,
|
||||
"proven": True,
|
||||
"bootstrap_path": "clean_canonical_control_checkout",
|
||||
"reasons": [
|
||||
"control checkout is clean on accepted base branch matching live master"
|
||||
],
|
||||
}
|
||||
|
||||
|
||||
import fcntl
|
||||
|
||||
|
||||
class BootstrapTransitionLock:
|
||||
"""Inter-process file lock scoped to the transition identity / idempotency key."""
|
||||
|
||||
def __init__(self, idempotency_key: str, journal_dir: str | None = None):
|
||||
safe_key = "".join(
|
||||
c if c.isalnum() or c in ("-", "_", ".") else "_"
|
||||
for c in idempotency_key
|
||||
)
|
||||
lock_dir = get_journal_dir(journal_dir)
|
||||
self.lock_path = os.path.join(lock_dir, f"{safe_key}.lock")
|
||||
self.fd = None
|
||||
|
||||
def __enter__(self):
|
||||
self.fd = open(self.lock_path, "a+")
|
||||
fcntl.flock(self.fd, fcntl.LOCK_EX)
|
||||
return self
|
||||
|
||||
def __exit__(self, exc_type, exc_val, exc_tb):
|
||||
if self.fd:
|
||||
try:
|
||||
fcntl.flock(self.fd, fcntl.LOCK_UN)
|
||||
except Exception:
|
||||
pass
|
||||
try:
|
||||
self.fd.close()
|
||||
except Exception:
|
||||
pass
|
||||
self.fd = None
|
||||
|
||||
|
||||
def bootstrap_author_issue_worktree(
|
||||
*,
|
||||
issue_number: int,
|
||||
canonical_repo_root: str,
|
||||
assignment_id: str | None = None,
|
||||
lease_id: str | None = None,
|
||||
expected_base_sha: str | None = None,
|
||||
branch_name: str | None = None,
|
||||
worktree_path: str | None = None,
|
||||
idempotency_key: str | None = None,
|
||||
remote: str = "prgs",
|
||||
host: str | None = None,
|
||||
org: str | None = "Scaled-Tech-Consulting",
|
||||
repo: str | None = "Gitea-Tools",
|
||||
active_identity: str | None = "jcwalker3",
|
||||
active_profile: str | None = "prgs-author",
|
||||
owner_session: str | None = None,
|
||||
lock_dir: str | None = None,
|
||||
dry_run: bool = False,
|
||||
) -> dict[str, Any]:
|
||||
"""Execute the sanctioned author issue worktree bootstrap transition."""
|
||||
root = os.path.realpath(canonical_repo_root)
|
||||
|
||||
# Derive standard inputs
|
||||
expected_pattern = f"issue-{issue_number}"
|
||||
target_branch = (branch_name or "").strip()
|
||||
if not target_branch:
|
||||
target_branch = f"fix/issue-{issue_number}-native-mcp-bootstrap"
|
||||
elif expected_pattern not in target_branch:
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "invalid_branch_name",
|
||||
"message": (
|
||||
f"Branch name '{target_branch}' must contain issue pattern '{expected_pattern}'"
|
||||
),
|
||||
"exact_next_action": (
|
||||
f"Supply a branch_name containing '{expected_pattern}', e.g., 'fix/issue-{issue_number}-...'"
|
||||
),
|
||||
}
|
||||
|
||||
worktree_name = target_branch.replace("/", "-")
|
||||
target_worktree = (worktree_path or "").strip()
|
||||
if not target_worktree:
|
||||
target_worktree = os.path.join(root, "branches", worktree_name)
|
||||
target_worktree = os.path.realpath(os.path.abspath(target_worktree))
|
||||
|
||||
key = (idempotency_key or "").strip()
|
||||
if not key:
|
||||
key = derive_default_idempotency_key(
|
||||
remote=remote,
|
||||
org=org,
|
||||
repo=repo,
|
||||
issue_number=issue_number,
|
||||
assignment_id=assignment_id,
|
||||
lease_id=lease_id,
|
||||
)
|
||||
|
||||
# Acquire cross-process file lock scoped to the idempotency key / transition identity
|
||||
with BootstrapTransitionLock(key):
|
||||
# Idempotency check
|
||||
existing = load_phase_journal(key)
|
||||
if existing and existing.get("completed"):
|
||||
if (
|
||||
existing.get("issue_number") == issue_number
|
||||
and existing.get("branch_name") == target_branch
|
||||
and os.path.realpath(existing.get("worktree_path", ""))
|
||||
== target_worktree
|
||||
):
|
||||
return {
|
||||
"success": True,
|
||||
"replayed": True,
|
||||
"message": (
|
||||
f"Idempotent replay: worktree for issue #{issue_number} already bootstrapped at {target_worktree}"
|
||||
),
|
||||
"issue_number": issue_number,
|
||||
"branch_name": target_branch,
|
||||
"worktree_path": target_worktree,
|
||||
"base_sha": existing.get("resolved_base_sha"),
|
||||
"lease_id": existing.get("lease_id"),
|
||||
"assignment_id": existing.get("assignment_id"),
|
||||
"idempotency_key": key,
|
||||
"phase_journal": existing,
|
||||
"exact_next_action": (
|
||||
f"Call gitea_whoami, then gitea_resolve_task_capability(task='work_issue', worktree_path='{target_worktree}') "
|
||||
"and proceed with author implementation in the bootstrapped worktree."
|
||||
),
|
||||
}
|
||||
else:
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "incompatible_idempotency_replay",
|
||||
"message": (
|
||||
f"Idempotency key '{key}' already exists with incompatible parameters "
|
||||
f"(stored: {existing.get('branch_name')}, {existing.get('worktree_path')}; "
|
||||
f"requested: {target_branch}, {target_worktree})"
|
||||
),
|
||||
"exact_next_action": (
|
||||
"Supply a unique idempotency_key or pass compatible parameters."
|
||||
),
|
||||
}
|
||||
|
||||
# Initialize or resume Phase Journal
|
||||
if existing:
|
||||
journal = existing
|
||||
artifacts = journal.setdefault("artifacts_created", {})
|
||||
artifacts.setdefault("branch_created", False)
|
||||
artifacts.setdefault("worktree_dir_created", False)
|
||||
artifacts.setdefault("worktree_registered", False)
|
||||
artifacts.setdefault("lock_created", False)
|
||||
else:
|
||||
journal = {
|
||||
"idempotency_key": key,
|
||||
"issue_number": issue_number,
|
||||
"assignment_id": assignment_id,
|
||||
"lease_id": lease_id,
|
||||
"expected_base_sha": expected_base_sha,
|
||||
"resolved_base_sha": None,
|
||||
"branch_name": target_branch,
|
||||
"worktree_path": target_worktree,
|
||||
"active_identity": active_identity,
|
||||
"active_profile": active_profile,
|
||||
"owner_session": owner_session,
|
||||
"remote": remote,
|
||||
"org": org,
|
||||
"repo": repo,
|
||||
"phases": {},
|
||||
"artifacts_created": {
|
||||
"branch_created": False,
|
||||
"worktree_dir_created": False,
|
||||
"worktree_registered": False,
|
||||
"lock_created": False,
|
||||
},
|
||||
"current_phase": PHASE_1_REQUEST_ACCEPTED,
|
||||
"completed": False,
|
||||
}
|
||||
|
||||
# Fetch current live master SHA
|
||||
try:
|
||||
rev_res = subprocess.run(
|
||||
["git", "-C", root, "rev-parse", "HEAD"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=True,
|
||||
)
|
||||
live_master_sha = rev_res.stdout.strip()
|
||||
except Exception as exc:
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "git_rev_parse_failed",
|
||||
"message": f"Could not determine repository HEAD: {exc}",
|
||||
"exact_next_action": "Verify repository git state and retry.",
|
||||
}
|
||||
|
||||
# Phase 1: REQUEST_ACCEPTED & Concurrency Pin Check
|
||||
if expected_base_sha:
|
||||
exp_norm = expected_base_sha.strip().lower()
|
||||
live_norm = live_master_sha.lower()
|
||||
if exp_norm != live_norm:
|
||||
journal["failure_reason"] = (
|
||||
f"stale concurrency pin: expected {exp_norm[:12]} != live {live_norm[:12]}"
|
||||
)
|
||||
save_phase_journal(journal)
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "stale_concurrency_pin",
|
||||
"message": (
|
||||
f"Expected base SHA {exp_norm[:12]} does not match live master SHA {live_norm[:12]} (fail closed)."
|
||||
),
|
||||
"expected_base_sha": expected_base_sha,
|
||||
"live_master_sha": live_master_sha,
|
||||
"exact_next_action": (
|
||||
"Re-evaluate assignment against current live master SHA and retry with updated expected_base_sha."
|
||||
),
|
||||
}
|
||||
|
||||
journal["resolved_base_sha"] = live_master_sha
|
||||
journal["phases"][PHASE_1_REQUEST_ACCEPTED] = {
|
||||
"status": "completed",
|
||||
"live_master_sha": live_master_sha,
|
||||
"expected_base_sha": expected_base_sha,
|
||||
}
|
||||
journal["current_phase"] = PHASE_2_BRANCH_CONFIRMED
|
||||
save_phase_journal(journal)
|
||||
|
||||
if dry_run:
|
||||
return {
|
||||
"success": True,
|
||||
"dry_run": True,
|
||||
"message": f"Dry-run: validated bootstrap intent for issue #{issue_number}",
|
||||
"issue_number": issue_number,
|
||||
"branch_name": target_branch,
|
||||
"worktree_path": target_worktree,
|
||||
"base_sha": live_master_sha,
|
||||
"phase_journal": journal,
|
||||
"exact_next_action": "Run without dry_run=True to execute bootstrap.",
|
||||
}
|
||||
|
||||
# Phase 2: BRANCH_CONFIRMED
|
||||
was_branch_created_previously = journal["artifacts_created"].get("branch_created", False)
|
||||
branch_check = subprocess.run(
|
||||
["git", "-C", root, "rev-parse", "--verify", target_branch],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
if branch_check.returncode == 0:
|
||||
branch_head = branch_check.stdout.strip()
|
||||
# Verify branch head descends from base
|
||||
anc_check = subprocess.run(
|
||||
[
|
||||
"git",
|
||||
"-C",
|
||||
root,
|
||||
"merge-base",
|
||||
"--is-ancestor",
|
||||
live_master_sha,
|
||||
branch_head,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
if anc_check.returncode != 0 and branch_head.lower() != live_master_sha.lower():
|
||||
journal["failure_reason"] = (
|
||||
f"existing branch '{target_branch}' HEAD ({branch_head[:12]}) does not descend from base ({live_master_sha[:12]})"
|
||||
)
|
||||
save_phase_journal(journal)
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "incompatible_existing_branch",
|
||||
"message": (
|
||||
f"Existing branch '{target_branch}' HEAD ({branch_head[:12]}) is incompatible with live master ({live_master_sha[:12]})."
|
||||
),
|
||||
"exact_next_action": (
|
||||
"Inspect or remove the incompatible branch before bootstrapping."
|
||||
),
|
||||
}
|
||||
# Preserve creation provenance monotonically across interruption and replay
|
||||
journal["artifacts_created"]["branch_created"] = was_branch_created_previously
|
||||
else:
|
||||
# Create branch
|
||||
create_res = subprocess.run(
|
||||
["git", "-C", root, "branch", target_branch, live_master_sha],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
if create_res.returncode != 0:
|
||||
journal["failure_reason"] = (
|
||||
f"failed to create git branch '{target_branch}': {create_res.stderr.strip()}"
|
||||
)
|
||||
save_phase_journal(journal)
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "branch_creation_failed",
|
||||
"message": f"Failed to create git branch '{target_branch}': {create_res.stderr.strip()}",
|
||||
"exact_next_action": "Verify branch availability and retry.",
|
||||
}
|
||||
journal["artifacts_created"]["branch_created"] = True
|
||||
|
||||
journal["phases"][PHASE_2_BRANCH_CONFIRMED] = {
|
||||
"status": "completed",
|
||||
"branch_name": target_branch,
|
||||
"created": journal["artifacts_created"]["branch_created"],
|
||||
}
|
||||
journal["current_phase"] = PHASE_3_PATH_RESERVED
|
||||
save_phase_journal(journal)
|
||||
|
||||
# Phase 3: PATH_RESERVED & Phase 4: WORKTREE_CONFIRMED
|
||||
if not author_mutation_worktree.is_path_under_branches(
|
||||
target_worktree, root
|
||||
):
|
||||
journal["failure_reason"] = (
|
||||
f"target_worktree '{target_worktree}' is outside canonical branches/ root"
|
||||
)
|
||||
run_compensating_recovery(journal, root)
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "path_outside_canonical_branches_root",
|
||||
"message": (
|
||||
f"Worktree path '{target_worktree}' is outside canonical branches/ root (fail closed)."
|
||||
),
|
||||
"exact_next_action": (
|
||||
"Provide a worktree_path inside canonical branches/ root, e.g., 'branches/issue-...'"
|
||||
),
|
||||
}
|
||||
|
||||
was_dir_created_previously = journal["artifacts_created"].get("worktree_dir_created", False)
|
||||
was_registered_previously = journal["artifacts_created"].get("worktree_registered", False)
|
||||
|
||||
dir_exists = os.path.exists(target_worktree)
|
||||
if dir_exists:
|
||||
# Check porcelain directly
|
||||
porc_res = subprocess.run(
|
||||
["git", "-C", target_worktree, "status", "--porcelain"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
dirty = (
|
||||
parse_dirty_tracked_files(porc_res.stdout)
|
||||
if porc_res.returncode == 0
|
||||
else []
|
||||
)
|
||||
if dirty or (porc_res.returncode == 0 and porc_res.stdout.strip()):
|
||||
journal["failure_reason"] = (
|
||||
f"target worktree '{target_worktree}' contains dirty tracked/untracked files"
|
||||
)
|
||||
run_compensating_recovery(journal, root)
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "preexisting_dirty_worktree",
|
||||
"message": (
|
||||
f"Preexisting worktree '{target_worktree}' has dirty tracked/untracked files (fail closed)."
|
||||
),
|
||||
"exact_next_action": (
|
||||
"Clean or stash the pre-existing worktree files before bootstrapping."
|
||||
),
|
||||
}
|
||||
|
||||
# Check registered branch
|
||||
wt_state = issue_lock_worktree.read_worktree_git_state(target_worktree)
|
||||
wt_branch = (wt_state.get("current_branch") or "").strip()
|
||||
if wt_branch and wt_branch != target_branch:
|
||||
journal["failure_reason"] = (
|
||||
f"existing worktree '{target_worktree}' is on branch '{wt_branch}' != expected '{target_branch}'"
|
||||
)
|
||||
run_compensating_recovery(journal, root)
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "incompatible_existing_directory",
|
||||
"message": (
|
||||
f"Existing worktree '{target_worktree}' is registered to branch '{wt_branch}' instead of '{target_branch}'."
|
||||
),
|
||||
"exact_next_action": (
|
||||
"Inspect or remove the pre-existing worktree folder before bootstrapping."
|
||||
),
|
||||
}
|
||||
journal["artifacts_created"]["worktree_dir_created"] = was_dir_created_previously
|
||||
journal["artifacts_created"]["worktree_registered"] = (
|
||||
was_registered_previously or was_dir_created_previously
|
||||
)
|
||||
else:
|
||||
wt_add_res = subprocess.run(
|
||||
[
|
||||
"git",
|
||||
"-C",
|
||||
root,
|
||||
"worktree",
|
||||
"add",
|
||||
target_worktree,
|
||||
target_branch,
|
||||
],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
if wt_add_res.returncode != 0:
|
||||
journal["failure_reason"] = (
|
||||
f"git worktree add failed: {wt_add_res.stderr.strip()}"
|
||||
)
|
||||
run_compensating_recovery(journal, root)
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "worktree_add_failed",
|
||||
"message": f"Failed to execute git worktree add: {wt_add_res.stderr.strip()}",
|
||||
"exact_next_action": "Verify git worktree capabilities and retry.",
|
||||
}
|
||||
journal["artifacts_created"]["worktree_dir_created"] = True
|
||||
journal["artifacts_created"]["worktree_registered"] = True
|
||||
|
||||
journal["phases"][PHASE_3_PATH_RESERVED] = {
|
||||
"status": "completed",
|
||||
"worktree_path": target_worktree,
|
||||
"preexisting_dir": dir_exists,
|
||||
}
|
||||
journal["current_phase"] = PHASE_4_WORKTREE_CONFIRMED
|
||||
save_phase_journal(journal)
|
||||
|
||||
# Phase 5: REGISTRATION_VERIFIED
|
||||
wt_list_res = subprocess.run(
|
||||
["git", "-C", root, "worktree", "list", "--porcelain"],
|
||||
capture_output=True,
|
||||
text=True,
|
||||
check=False,
|
||||
)
|
||||
norm_target = os.path.realpath(target_worktree)
|
||||
found_registration = False
|
||||
if wt_list_res.returncode == 0:
|
||||
for block in wt_list_res.stdout.split("\n\n"):
|
||||
lines = block.strip().splitlines()
|
||||
worktree_line = next(
|
||||
(l[9:].strip() for l in lines if l.startswith("worktree ")),
|
||||
None,
|
||||
)
|
||||
if worktree_line and os.path.realpath(worktree_line) == norm_target:
|
||||
found_registration = True
|
||||
break
|
||||
|
||||
if not found_registration:
|
||||
journal["failure_reason"] = (
|
||||
f"worktree registration for '{target_worktree}' not found in git worktree list"
|
||||
)
|
||||
run_compensating_recovery(journal, root)
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "worktree_registration_verification_failed",
|
||||
"message": f"Worktree '{target_worktree}' registration verification failed.",
|
||||
"exact_next_action": "Check git worktree list integrity and retry.",
|
||||
}
|
||||
|
||||
journal["phases"][PHASE_4_WORKTREE_CONFIRMED] = {
|
||||
"status": "completed",
|
||||
"worktree_path": target_worktree,
|
||||
}
|
||||
journal["phases"][PHASE_5_REGISTRATION_VERIFIED] = {
|
||||
"status": "completed",
|
||||
"registered": True,
|
||||
}
|
||||
journal["current_phase"] = PHASE_6_STATE_ESTABLISHED
|
||||
save_phase_journal(journal)
|
||||
|
||||
# Phase 6: STATE_ESTABLISHED — Issue Lock Acquisition
|
||||
from datetime import datetime, timezone
|
||||
try:
|
||||
lock_data = {
|
||||
"remote": remote,
|
||||
"org": org or "Scaled-Tech-Consulting",
|
||||
"repo": repo or "Gitea-Tools",
|
||||
"issue_number": issue_number,
|
||||
"branch": target_branch,
|
||||
"branch_name": target_branch,
|
||||
"worktree_path": target_worktree,
|
||||
"owner_session": owner_session or "prgs-author-95048-63667752",
|
||||
"claimant": {
|
||||
"username": active_identity or "jcwalker3",
|
||||
"profile": active_profile or "prgs-author",
|
||||
},
|
||||
"assignment_id": assignment_id,
|
||||
"lease_id": lease_id,
|
||||
"expected_base_sha": live_master_sha,
|
||||
"created_at": datetime.now(timezone.utc).isoformat(),
|
||||
}
|
||||
lock_res = issue_lock_store.bind_session_lock(lock_data, lock_dir=lock_dir)
|
||||
journal["artifacts_created"]["lock_created"] = True
|
||||
except Exception as exc:
|
||||
journal["failure_reason"] = f"issue lock binding failed: {exc}"
|
||||
run_compensating_recovery(journal, root)
|
||||
return {
|
||||
"success": False,
|
||||
"reason_code": "issue_lock_acquisition_failed",
|
||||
"message": f"Could not bind canonical issue lock for issue #{issue_number}: {exc}",
|
||||
"exact_next_action": "Verify lease/assignment state and retry.",
|
||||
}
|
||||
|
||||
journal["phases"][PHASE_6_STATE_ESTABLISHED] = {
|
||||
"status": "completed",
|
||||
"lock": lock_res,
|
||||
}
|
||||
journal["phases"][PHASE_7_TRANSITION_COMPLETED] = {
|
||||
"status": "completed",
|
||||
}
|
||||
journal["current_phase"] = PHASE_7_TRANSITION_COMPLETED
|
||||
journal["completed"] = True
|
||||
save_phase_journal(journal)
|
||||
|
||||
return {
|
||||
"success": True,
|
||||
"replayed": False,
|
||||
"message": (
|
||||
f"Successfully bootstrapped author issue worktree for issue #{issue_number} "
|
||||
f"at branch '{target_branch}' and worktree '{target_worktree}'."
|
||||
),
|
||||
"issue_number": issue_number,
|
||||
"branch_name": target_branch,
|
||||
"worktree_path": target_worktree,
|
||||
"base_sha": live_master_sha,
|
||||
"lease_id": lease_id,
|
||||
"assignment_id": assignment_id,
|
||||
"idempotency_key": key,
|
||||
"lock_state": lock_res,
|
||||
"phase_journal": journal,
|
||||
"exact_next_action": (
|
||||
f"Call gitea_whoami, then gitea_resolve_task_capability(task='work_issue', worktree_path='{target_worktree}') "
|
||||
"and proceed with author implementation in the bootstrapped worktree."
|
||||
),
|
||||
}
|
||||
+11
-31
@@ -40,41 +40,21 @@ def _normalize_path(path: str) -> str:
|
||||
return (path or "").replace("\\", "/").rstrip("/")
|
||||
|
||||
|
||||
def get_canonical_branches_root(project_root: str | None = None) -> str:
|
||||
"""Resolve the exact canonical branches root directory for the repository."""
|
||||
if project_root:
|
||||
root = os.path.realpath(project_root)
|
||||
else:
|
||||
root = os.path.realpath(os.getcwd())
|
||||
|
||||
norm = root.replace("\\", "/")
|
||||
if "/branches/" in norm:
|
||||
base_part = norm.split("/branches/")[0]
|
||||
return os.path.realpath(os.path.join(base_part, "branches"))
|
||||
elif norm.endswith("/branches"):
|
||||
return os.path.realpath(norm)
|
||||
|
||||
return os.path.realpath(os.path.join(root, "branches"))
|
||||
|
||||
|
||||
def is_path_under_branches(path: str, project_root: str | None = None) -> bool:
|
||||
"""True when *path* resolves inside ``<canonical_repo_root>/branches/``."""
|
||||
if not path or not str(path).strip():
|
||||
"""True when *path* resolves inside ``<project_root>/branches/``."""
|
||||
normalized = _normalize_path(path)
|
||||
if not normalized:
|
||||
return False
|
||||
try:
|
||||
real_path = os.path.realpath(os.path.abspath(str(path).strip()))
|
||||
except Exception:
|
||||
return False
|
||||
|
||||
branches_root = get_canonical_branches_root(project_root)
|
||||
|
||||
if real_path == branches_root:
|
||||
if "/branches/" in f"{normalized}/":
|
||||
return True
|
||||
|
||||
prefix = branches_root + os.sep
|
||||
if real_path.startswith(prefix):
|
||||
if normalized.endswith("/branches"):
|
||||
return True
|
||||
|
||||
if project_root:
|
||||
root = _normalize_path(os.path.realpath(project_root))
|
||||
real = _normalize_path(os.path.realpath(path))
|
||||
if real.startswith(f"{root}/"):
|
||||
rel = real[len(root) + 1 :]
|
||||
return rel == "branches" or rel.startswith("branches/")
|
||||
return False
|
||||
|
||||
|
||||
|
||||
@@ -247,8 +247,7 @@ def bootstrap_permits_control_checkout(
|
||||
"""
|
||||
if not isinstance(assessment, dict):
|
||||
return False
|
||||
import author_issue_bootstrap
|
||||
if not is_create_issue_task(task) and not author_issue_bootstrap.is_author_issue_bootstrap_task(task):
|
||||
if not is_create_issue_task(task):
|
||||
return False
|
||||
|
||||
# Positive proof: the assessment must affirmatively allow, with no
|
||||
|
||||
@@ -69,7 +69,6 @@ that gates each call, not which tools exist.
|
||||
- `gitea_audit_worktree_cleanup`
|
||||
- `gitea_authorize_reconciliation_cleanup_phase`
|
||||
- `gitea_authorize_review_correction`
|
||||
- `gitea_bootstrap_author_issue_worktree`
|
||||
- `gitea_capability_stop_terminal_report`
|
||||
- `gitea_capture_branches_worktree_snapshot`
|
||||
- `gitea_check_pr_eligibility`
|
||||
|
||||
@@ -65,6 +65,8 @@ status, onboarding checklist state, and the fail-closed error payloads (#635).
|
||||
| `/api/prompts` | JSON prompt export with workflow hashes |
|
||||
| `/runtime` | MCP runtime health and stale detection (#430) |
|
||||
| `/api/runtime` | JSON runtime health export |
|
||||
| `/policy` | Workflow policy and guardrail configuration visibility (#646) |
|
||||
| `/api/v1/policy` | Versioned JSON guardrail inventory (redacted, read-only) |
|
||||
| `/audit` | Report audit paste + validator preview (#431) |
|
||||
| `/api/audit` | JSON validator preview (POST `report_text`, optional `task_kind`) |
|
||||
| `/worktrees` | Worktree hygiene dashboard (#432) |
|
||||
@@ -233,6 +235,19 @@ health, workflow/schema SHA-256 hashes, and stale-runtime warnings when the
|
||||
checkout is behind merged safety-gate changes. Restart guidance links to #420;
|
||||
no tokens or MCP restart actions are exposed.
|
||||
|
||||
## Policy & guardrail visibility (#646)
|
||||
|
||||
`/policy` (HTML) and `/api/v1/policy` (JSON) surface a **read-only** projection
|
||||
of the major workflow guardrails — role separation/RBAC, lease lifecycle,
|
||||
author worktree binding, merge confirmation, secret redaction, contamination
|
||||
containment, allocator policy, audit logging, and mutation gating. Each entry
|
||||
carries source pointers to the file/module/doc that owns it, a compact active
|
||||
value derived from the existing safe policy accessors, and — where a documented
|
||||
default is declared — a diff of active vs documented. The whole payload is run
|
||||
through the console redaction pass before it is emitted, so a planted or
|
||||
accidental secret degrades to the placeholder rather than reaching a client.
|
||||
The view never edits policy and exposes no gate-weakening toggle.
|
||||
|
||||
## Deployment boundary (#435)
|
||||
|
||||
MVP serves on loopback by default. Binding `0.0.0.0` or `::` is **refused**
|
||||
|
||||
+4
-133
@@ -958,32 +958,6 @@ def _create_issue_bootstrap_assessment(
|
||||
"""
|
||||
import create_issue_bootstrap as _cib
|
||||
|
||||
import author_issue_bootstrap as _aib
|
||||
if _aib.is_author_issue_bootstrap_task(task):
|
||||
ctx = _resolve_namespace_mutation_context(worktree_path)
|
||||
workspace = ctx["workspace_path"]
|
||||
git_state = issue_lock_worktree.read_worktree_git_state(workspace)
|
||||
remote_master_sha_error: str | None = None
|
||||
try:
|
||||
remote_master_sha = root_checkout_guard.resolve_remote_master_sha(
|
||||
ctx["canonical_repo_root"]
|
||||
)
|
||||
except Exception as exc:
|
||||
remote_master_sha = None
|
||||
remote_master_sha_error = (
|
||||
f"{type(exc).__name__}: {exc}".strip() or "resolver failed"
|
||||
)
|
||||
return _aib.assess_author_issue_bootstrap(
|
||||
workspace_path=workspace,
|
||||
canonical_repo_root=ctx["canonical_repo_root"],
|
||||
current_branch=git_state.get("current_branch"),
|
||||
head_sha=git_state.get("head_sha"),
|
||||
porcelain_status=git_state.get("porcelain_status") or "",
|
||||
remote_master_sha=remote_master_sha,
|
||||
remote_master_sha_error=remote_master_sha_error,
|
||||
task=task,
|
||||
)
|
||||
|
||||
if not _cib.is_create_issue_task(task):
|
||||
return None
|
||||
|
||||
@@ -9369,96 +9343,6 @@ def gitea_publish_unpublished_issue_branch(
|
||||
}
|
||||
|
||||
|
||||
@mcp.tool()
|
||||
def gitea_bootstrap_author_issue_worktree(
|
||||
issue_number: int,
|
||||
assignment_id: str | None = None,
|
||||
lease_id: str | None = None,
|
||||
expected_base_sha: str | None = None,
|
||||
branch_name: str | None = None,
|
||||
worktree_path: str | None = None,
|
||||
idempotency_key: str | None = None,
|
||||
remote: str = "dadeschools",
|
||||
host: str | None = None,
|
||||
org: str | None = None,
|
||||
repo: str | None = None,
|
||||
dry_run: bool = False,
|
||||
) -> dict:
|
||||
"""Bootstrap an allocated author issue branch and registered worktree (#850).
|
||||
|
||||
Sanctioned MCP transition that creates or recovers the issue branch and
|
||||
registered worktree under ``branches/``, binds it to the assignment/lease,
|
||||
and makes it eligible for the canonical issue lock without touching the
|
||||
stable control checkout.
|
||||
|
||||
Args:
|
||||
issue_number: Allocated issue number to bootstrap.
|
||||
assignment_id: Optional allocation assignment ID.
|
||||
lease_id: Optional workflow lease ID.
|
||||
expected_base_sha: Authoritative expected base SHA / concurrency pin.
|
||||
branch_name: Optional custom branch name (must match issue-<N> pattern).
|
||||
worktree_path: Optional custom worktree path under branches/.
|
||||
idempotency_key: Optional key for idempotent replay/resume.
|
||||
remote: Known instance — 'dadeschools' or 'prgs'.
|
||||
host: Override Gitea host.
|
||||
org: Override Org.
|
||||
repo: Override Repo.
|
||||
dry_run: Report planned transition without mutating repository.
|
||||
"""
|
||||
task = "bootstrap_author_issue_worktree"
|
||||
ok, block_reasons = role_session_router.check_author_mutation_after_reviewer_stop(
|
||||
task
|
||||
)
|
||||
if not ok:
|
||||
return _author_mutation_block(block_reasons)
|
||||
|
||||
blocked = _namespace_mutation_block(task, remote=remote)
|
||||
if blocked:
|
||||
return blocked
|
||||
blocked = _profile_permission_block(
|
||||
task_capability_map.required_permission(task),
|
||||
remote=remote,
|
||||
host=host,
|
||||
org=org,
|
||||
repo=repo,
|
||||
org_explicit=org is not None,
|
||||
repo_explicit=repo is not None,
|
||||
)
|
||||
if blocked:
|
||||
return blocked
|
||||
|
||||
verify_preflight_purity(
|
||||
remote,
|
||||
task=task,
|
||||
org=org,
|
||||
repo=repo,
|
||||
)
|
||||
|
||||
h, o, r = _resolve(remote, host, org, repo)
|
||||
canonical_root = _canonical_local_git_root()
|
||||
|
||||
import author_issue_bootstrap
|
||||
|
||||
return author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=issue_number,
|
||||
canonical_repo_root=canonical_root,
|
||||
assignment_id=assignment_id,
|
||||
lease_id=lease_id,
|
||||
expected_base_sha=expected_base_sha,
|
||||
branch_name=branch_name,
|
||||
worktree_path=worktree_path,
|
||||
idempotency_key=idempotency_key,
|
||||
remote=remote,
|
||||
host=h,
|
||||
org=o,
|
||||
repo=r,
|
||||
active_identity=_active_username(),
|
||||
active_profile=_active_profile_name(),
|
||||
owner_session=_current_session_id(),
|
||||
dry_run=dry_run,
|
||||
)
|
||||
|
||||
|
||||
# Merge methods supported by the Gitea merge API.
|
||||
_MERGE_METHODS = ("merge", "squash", "rebase")
|
||||
|
||||
@@ -19319,12 +19203,6 @@ def gitea_resolve_task_capability(
|
||||
task: str,
|
||||
remote: str = "dadeschools",
|
||||
host: str | None = None,
|
||||
org: str | None = None,
|
||||
repo: str | None = None,
|
||||
issue_number: int | None = None,
|
||||
worktree_path: str | None = None,
|
||||
pr_number: int | None = None,
|
||||
**kwargs: Any,
|
||||
) -> dict:
|
||||
"""Read-only / side-effect free: resolve capability, profile, and namespace for a task.
|
||||
|
||||
@@ -19341,17 +19219,13 @@ def gitea_resolve_task_capability(
|
||||
remote: Known remote instance name.
|
||||
host: Optional override for the Gitea host.
|
||||
"""
|
||||
import importlib
|
||||
importlib.reload(task_capability_map)
|
||||
importlib.reload(role_session_router)
|
||||
task_key = task_capability_map._canonical_preflight_task(task)
|
||||
TASK_MAP = task_capability_map.TASK_CAPABILITY_MAP
|
||||
# Every fresh attempt invalidates the previous task/role stamp before any
|
||||
# fallible resolver work. Unknown/malformed tasks and unexpected failures
|
||||
# therefore remain fail-closed instead of preserving stale authority.
|
||||
_clear_resolved_capability_stamp()
|
||||
|
||||
if task_key not in TASK_MAP:
|
||||
if task not in TASK_MAP:
|
||||
# #723: structured fail-closed unknown_task (never raise into internal_error).
|
||||
profile = get_profile()
|
||||
h = host or (REMOTES.get(remote, {}).get("host") if remote in REMOTES else None)
|
||||
@@ -19397,8 +19271,8 @@ def gitea_resolve_task_capability(
|
||||
result["cleared_stale_denial"] = True
|
||||
return result
|
||||
|
||||
required_permission = task_capability_map.required_permission(task_key)
|
||||
required_role = task_capability_map.required_role(task_key)
|
||||
required_permission = task_capability_map.required_permission(task)
|
||||
required_role = task_capability_map.required_role(task)
|
||||
role_exclusive_tasks = task_capability_map.ROLE_EXCLUSIVE_TASKS
|
||||
|
||||
infra_assessment = role_session_router.assess_infra_stop(PROJECT_ROOT)
|
||||
@@ -19584,10 +19458,7 @@ def gitea_resolve_task_capability(
|
||||
available_in_session = allowed_in_current_session
|
||||
runtime_stale_blocker = False
|
||||
|
||||
if (
|
||||
"PYTEST_CURRENT_TEST" not in os.environ
|
||||
or "GITEA_FORCE_MCP_RUNTIME_CHECK" in os.environ
|
||||
) and os.environ.get("GITEA_ALLOW_STALE_RUNTIME") != "1":
|
||||
if "PYTEST_CURRENT_TEST" not in os.environ or "GITEA_FORCE_MCP_RUNTIME_CHECK" in os.environ:
|
||||
runtime_reasons = _check_mcp_runtimes_diagnostics(task, matching_profiles)
|
||||
if runtime_reasons:
|
||||
restart_required = True
|
||||
|
||||
@@ -73,8 +73,6 @@ AUTHOR_TASKS = frozenset({
|
||||
"claim_issue",
|
||||
"create_branch",
|
||||
"push_branch",
|
||||
"bootstrap_author_issue_worktree",
|
||||
"gitea_bootstrap_author_issue_worktree",
|
||||
"create_pr",
|
||||
"comment_pr",
|
||||
"address_pr_change_requests",
|
||||
|
||||
@@ -58,14 +58,6 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
|
||||
"permission": "gitea.branch.create",
|
||||
"role": "author",
|
||||
},
|
||||
"bootstrap_author_issue_worktree": {
|
||||
"permission": "gitea.branch.create",
|
||||
"role": "author",
|
||||
},
|
||||
"gitea_bootstrap_author_issue_worktree": {
|
||||
"permission": "gitea.branch.create",
|
||||
"role": "author",
|
||||
},
|
||||
"push_branch": {
|
||||
"permission": "gitea.branch.push",
|
||||
"role": "author",
|
||||
@@ -485,8 +477,6 @@ TASK_CAPABILITY_MAP: dict[str, dict[str, str]] = {
|
||||
# merger lease (#763).
|
||||
_PREFLIGHT_TASK_TRANSITIONS = frozenset({
|
||||
("review_pr", "acquire_reviewer_pr_lease"),
|
||||
("work_issue", "bootstrap_author_issue_worktree"),
|
||||
("bootstrap_author_issue_worktree", "lock_issue"),
|
||||
})
|
||||
|
||||
|
||||
@@ -533,8 +523,6 @@ ROLE_EXCLUSIVE_TASKS: frozenset[str] = frozenset(
|
||||
"gitea_release_merger_pr_lease",
|
||||
"create_branch",
|
||||
"push_branch",
|
||||
"bootstrap_author_issue_worktree",
|
||||
"gitea_bootstrap_author_issue_worktree",
|
||||
"publish_unpublished_branch",
|
||||
"create_pr",
|
||||
"commit_files",
|
||||
@@ -560,7 +548,6 @@ ISSUE_MUTATION_TOOL_TASKS: dict[str, str] = {
|
||||
"gitea_set_issue_labels": "set_issue_labels",
|
||||
"gitea_cleanup_terminal_pr_labels": "cleanup_terminal_pr_labels",
|
||||
"gitea_create_label": "create_label",
|
||||
"gitea_bootstrap_author_issue_worktree": "bootstrap_author_issue_worktree",
|
||||
"gitea_commit_files": "commit_files",
|
||||
}
|
||||
|
||||
|
||||
@@ -1,354 +0,0 @@
|
||||
"""Regression test suite for native author issue worktree bootstrap (#850)."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import json
|
||||
import os
|
||||
import shutil
|
||||
import subprocess
|
||||
import tempfile
|
||||
import unittest
|
||||
|
||||
import author_issue_bootstrap
|
||||
import task_capability_map
|
||||
|
||||
|
||||
def _concurrent_bootstrap_worker(args: tuple[str, int, str, str, str, str]) -> dict:
|
||||
repo_dir, issue_num, key, lock_dir, journal_dir, master_sha = args
|
||||
os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"] = journal_dir
|
||||
return author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=issue_num,
|
||||
canonical_repo_root=repo_dir,
|
||||
expected_base_sha=master_sha,
|
||||
idempotency_key=key,
|
||||
lock_dir=lock_dir,
|
||||
)
|
||||
|
||||
|
||||
class TestAuthorIssueBootstrap(unittest.TestCase):
|
||||
"""Test suite covering AC1-AC10 and comment #14959 specification."""
|
||||
|
||||
def setUp(self):
|
||||
self.tmp_dir = tempfile.mkdtemp(prefix="test_bootstrap_")
|
||||
self.repo_dir = os.path.join(self.tmp_dir, "repo")
|
||||
os.makedirs(self.repo_dir)
|
||||
|
||||
# Initialize synthetic git repo
|
||||
subprocess.run(["git", "init", "-b", "master"], cwd=self.repo_dir, check=True, capture_output=True)
|
||||
subprocess.run(["git", "config", "user.name", "Test User"], cwd=self.repo_dir, check=True)
|
||||
subprocess.run(["git", "config", "user.email", "[email protected]"], cwd=self.repo_dir, check=True)
|
||||
|
||||
readme = os.path.join(self.repo_dir, "README.md")
|
||||
with open(readme, "w", encoding="utf-8") as f:
|
||||
f.write("# Test Repo\n")
|
||||
subprocess.run(["git", "add", "README.md"], cwd=self.repo_dir, check=True, capture_output=True)
|
||||
subprocess.run(["git", "commit", "-m", "initial commit"], cwd=self.repo_dir, check=True, capture_output=True)
|
||||
|
||||
rev_res = subprocess.run(["git", "rev-parse", "HEAD"], cwd=self.repo_dir, capture_output=True, text=True, check=True)
|
||||
self.master_sha = rev_res.stdout.strip()
|
||||
|
||||
self.branches_dir = os.path.join(self.repo_dir, "branches")
|
||||
os.makedirs(self.branches_dir, exist_ok=True)
|
||||
self.lock_dir = os.path.join(self.tmp_dir, "locks")
|
||||
os.makedirs(self.lock_dir, exist_ok=True)
|
||||
self.journal_dir = os.path.join(self.tmp_dir, "journals")
|
||||
os.makedirs(self.journal_dir, exist_ok=True)
|
||||
os.environ["GITEA_BOOTSTRAP_JOURNAL_DIR"] = self.journal_dir
|
||||
|
||||
def tearDown(self):
|
||||
os.environ.pop("GITEA_BOOTSTRAP_JOURNAL_DIR", None)
|
||||
shutil.rmtree(self.tmp_dir, ignore_errors=True)
|
||||
|
||||
def test_bootstrap_success_path(self):
|
||||
"""AC1/AC3/AC8: Successful bootstrap creates branch, worktree, registration, and lock proof."""
|
||||
key = "test_key_success_1"
|
||||
res = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
assignment_id="asn-12345",
|
||||
lease_id="lease-67890",
|
||||
expected_base_sha=self.master_sha,
|
||||
idempotency_key=key,
|
||||
remote="prgs",
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
self.assertTrue(res.get("success"), f"Bootstrap failed: {res}")
|
||||
self.assertFalse(res.get("replayed"))
|
||||
self.assertEqual(res.get("issue_number"), 850)
|
||||
self.assertEqual(res.get("base_sha"), self.master_sha)
|
||||
self.assertIn("branches/fix-issue-850-native-mcp-bootstrap", res.get("worktree_path"))
|
||||
|
||||
# Verify worktree directory exists and is registered
|
||||
worktree_path = res["worktree_path"]
|
||||
self.assertTrue(os.path.isdir(worktree_path))
|
||||
|
||||
wt_list = subprocess.run(["git", "-C", self.repo_dir, "worktree", "list"], capture_output=True, text=True, check=True)
|
||||
self.assertIn(worktree_path, wt_list.stdout)
|
||||
|
||||
# Verify phase journal written
|
||||
journal = author_issue_bootstrap.load_phase_journal(key)
|
||||
self.assertIsNotNone(journal)
|
||||
self.assertTrue(journal.get("completed"))
|
||||
self.assertEqual(journal.get("current_phase"), author_issue_bootstrap.PHASE_7_TRANSITION_COMPLETED)
|
||||
|
||||
def test_idempotent_replay(self):
|
||||
"""Item 2: Replaying with identical key returns cached transition without duplicate creation."""
|
||||
key = "test_key_idempotent_1"
|
||||
res1 = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
idempotency_key=key,
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
self.assertTrue(res1["success"], f"res1 failed: {res1}")
|
||||
self.assertFalse(res1.get("replayed"))
|
||||
|
||||
# Second call
|
||||
res2 = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
idempotency_key=key,
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
self.assertTrue(res2["success"], f"res2 failed: {res2}")
|
||||
self.assertTrue(res2.get("replayed"))
|
||||
self.assertEqual(res1["worktree_path"], res2["worktree_path"])
|
||||
|
||||
def test_stale_concurrency_pin_refusal(self):
|
||||
"""Item 3: Mismatched expected base SHA fails closed without silent rebasing."""
|
||||
stale_sha = "0000000000000000000000000000000000000000"
|
||||
res = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
expected_base_sha=stale_sha,
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
self.assertFalse(res["success"])
|
||||
self.assertEqual(res.get("reason_code"), "stale_concurrency_pin")
|
||||
self.assertIn("exact_next_action", res)
|
||||
|
||||
def test_path_outside_branches_root_refusal(self):
|
||||
"""Item 6: Worktree path outside branches/ root is refused."""
|
||||
outside_path = os.path.join(self.tmp_dir, "outside_worktree")
|
||||
res = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
worktree_path=outside_path,
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
self.assertFalse(res["success"])
|
||||
self.assertEqual(res.get("reason_code"), "path_outside_canonical_branches_root")
|
||||
|
||||
def test_preexisting_dirty_worktree_preservation(self):
|
||||
"""Item 6: Preexisting dirty worktree fails closed and is NOT modified or cleaned."""
|
||||
branch = "fix/issue-850-dirty-test"
|
||||
wt_path = os.path.join(self.branches_dir, "fix-issue-850-dirty-test")
|
||||
subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", "-b", branch, wt_path], check=True, capture_output=True)
|
||||
|
||||
# Create dirty untracked file
|
||||
dirty_file = os.path.join(wt_path, "dirty.txt")
|
||||
with open(dirty_file, "w") as f:
|
||||
f.write("dirty edits\n")
|
||||
|
||||
res = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
branch_name=branch,
|
||||
worktree_path=wt_path,
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
self.assertFalse(res["success"])
|
||||
self.assertEqual(res.get("reason_code"), "preexisting_dirty_worktree")
|
||||
|
||||
# Prove dirty file is preserved byte-for-byte
|
||||
self.assertTrue(os.path.exists(dirty_file))
|
||||
with open(dirty_file, "r") as f:
|
||||
self.assertEqual(f.read(), "dirty edits\n")
|
||||
|
||||
def test_compensating_recovery_on_failed_phase(self):
|
||||
"""AC4/Item 4: Failure during transition rolls back ONLY newly created artifacts."""
|
||||
key = "test_key_recovery_1"
|
||||
# Simulate partial progress in journal
|
||||
journal = {
|
||||
"idempotency_key": key,
|
||||
"issue_number": 850,
|
||||
"branch_name": "fix/issue-850-recovery-test",
|
||||
"worktree_path": os.path.join(self.branches_dir, "fix-issue-850-recovery-test"),
|
||||
"artifacts_created": {
|
||||
"branch_created": True,
|
||||
"worktree_dir_created": True,
|
||||
"worktree_registered": True,
|
||||
"lock_created": False,
|
||||
},
|
||||
"failure_reason": "simulated lock failure",
|
||||
"current_phase": author_issue_bootstrap.PHASE_5_REGISTRATION_VERIFIED,
|
||||
"completed": False,
|
||||
}
|
||||
# Create the branch and worktree manually to simulate partial state
|
||||
subprocess.run(["git", "-C", self.repo_dir, "branch", journal["branch_name"]], check=True, capture_output=True)
|
||||
subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", journal["worktree_path"], journal["branch_name"]], check=True, capture_output=True)
|
||||
|
||||
# Run compensating recovery
|
||||
rec = author_issue_bootstrap.run_compensating_recovery(journal, self.repo_dir)
|
||||
self.assertTrue(rec["executed"])
|
||||
self.assertIn(f"worktree_path:{journal['worktree_path']}", rec["rolled_back"])
|
||||
self.assertIn(f"branch:{journal['branch_name']}", rec["rolled_back"])
|
||||
|
||||
# Prove worktree directory and branch were rolled back
|
||||
self.assertFalse(os.path.exists(journal["worktree_path"]))
|
||||
branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", journal["branch_name"]], capture_output=True, text=True, check=False)
|
||||
self.assertNotEqual(branch_check.returncode, 0)
|
||||
|
||||
def test_cross_process_concurrency(self):
|
||||
"""Review #525 Finding 1: Genuine cross-process concurrency locking prevents corruption."""
|
||||
import concurrent.futures
|
||||
|
||||
key = "test_concurrent_key_850"
|
||||
args = (self.repo_dir, 850, key, self.lock_dir, self.journal_dir, self.master_sha)
|
||||
|
||||
with concurrent.futures.ProcessPoolExecutor(max_workers=2) as executor:
|
||||
fut1 = executor.submit(_concurrent_bootstrap_worker, args)
|
||||
fut2 = executor.submit(_concurrent_bootstrap_worker, args)
|
||||
res1 = fut1.result(timeout=10)
|
||||
res2 = fut2.result(timeout=10)
|
||||
|
||||
self.assertTrue(res1["success"], f"res1 failed: {res1}")
|
||||
self.assertTrue(res2["success"], f"res2 failed: {res2}")
|
||||
# One process performs creation, the other process receives idempotent replay
|
||||
replayed_count = sum(1 for r in (res1, res2) if r.get("replayed"))
|
||||
created_count = sum(1 for r in (res1, res2) if not r.get("replayed"))
|
||||
self.assertEqual(replayed_count, 1)
|
||||
self.assertEqual(created_count, 1)
|
||||
self.assertEqual(res1["worktree_path"], res2["worktree_path"])
|
||||
|
||||
def test_interrupted_replay_preserves_artifacts_created_provenance(self):
|
||||
"""Review #525 Finding 2: Replaying incomplete journal preserves creation provenance monotonically."""
|
||||
key = "test_key_interrupted_replay_1"
|
||||
branch = "fix/issue-850-interrupted-replay"
|
||||
wt_path = os.path.join(self.branches_dir, "fix-issue-850-interrupted-replay")
|
||||
|
||||
# Simulate Phase 2/3 completion where branch and worktree directory were created by this transition
|
||||
journal = {
|
||||
"idempotency_key": key,
|
||||
"issue_number": 850,
|
||||
"branch_name": branch,
|
||||
"worktree_path": wt_path,
|
||||
"active_identity": "jcwalker3",
|
||||
"active_profile": "prgs-author",
|
||||
"remote": "prgs",
|
||||
"org": "Scaled-Tech-Consulting",
|
||||
"repo": "Gitea-Tools",
|
||||
"phases": {
|
||||
author_issue_bootstrap.PHASE_1_REQUEST_ACCEPTED: {"status": "completed"},
|
||||
author_issue_bootstrap.PHASE_2_BRANCH_CONFIRMED: {"status": "completed", "created": True},
|
||||
},
|
||||
"artifacts_created": {
|
||||
"branch_created": True,
|
||||
"worktree_dir_created": True,
|
||||
"worktree_registered": True,
|
||||
"lock_created": False,
|
||||
},
|
||||
"current_phase": author_issue_bootstrap.PHASE_3_PATH_RESERVED,
|
||||
"completed": False,
|
||||
}
|
||||
# Pre-create the branch and worktree on disk to simulate partial state after crash
|
||||
subprocess.run(["git", "-C", self.repo_dir, "branch", branch, self.master_sha], check=True, capture_output=True)
|
||||
subprocess.run(["git", "-C", self.repo_dir, "worktree", "add", wt_path, branch], check=True, capture_output=True)
|
||||
author_issue_bootstrap.save_phase_journal(journal)
|
||||
|
||||
# Now resume/replay the transition but simulate lock binding failure during Phase 6
|
||||
with unittest.mock.patch("issue_lock_store.bind_session_lock", side_effect=RuntimeError("Lock failure test")):
|
||||
res = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
branch_name=branch,
|
||||
worktree_path=wt_path,
|
||||
idempotency_key=key,
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
|
||||
self.assertFalse(res["success"])
|
||||
self.assertEqual(res.get("reason_code"), "issue_lock_acquisition_failed")
|
||||
|
||||
# Verify that compensating recovery correctly deleted transition-created branch & worktree
|
||||
# because creation provenance was preserved across replay (NOT downgraded to False!)
|
||||
self.assertFalse(os.path.exists(wt_path))
|
||||
branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", branch], capture_output=True, text=True, check=False)
|
||||
self.assertNotEqual(branch_check.returncode, 0)
|
||||
|
||||
def test_transition_created_only_compensation(self):
|
||||
"""Review #525 Finding 4: Preexisting branch is NOT deleted by compensation when only worktree was transition-created."""
|
||||
key = "test_key_preexisting_branch_compensation"
|
||||
preexisting_branch = "fix/issue-850-preexisting"
|
||||
wt_path = os.path.join(self.branches_dir, "fix-issue-850-preexisting")
|
||||
|
||||
# Create branch BEFORE bootstrap (preexisting branch)
|
||||
subprocess.run(["git", "-C", self.repo_dir, "branch", preexisting_branch, self.master_sha], check=True, capture_output=True)
|
||||
|
||||
# Call bootstrap with simulated failure during Phase 6 (lock binding)
|
||||
with unittest.mock.patch("issue_lock_store.bind_session_lock", side_effect=RuntimeError("Simulated lock failure")):
|
||||
res = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
branch_name=preexisting_branch,
|
||||
worktree_path=wt_path,
|
||||
idempotency_key=key,
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
|
||||
self.assertFalse(res["success"])
|
||||
# Worktree dir was created by transition -> removed by compensation
|
||||
self.assertFalse(os.path.exists(wt_path))
|
||||
|
||||
# Preexisting branch was NOT created by transition -> MUST BE PRESERVED!
|
||||
branch_check = subprocess.run(["git", "-C", self.repo_dir, "rev-parse", "--verify", preexisting_branch], capture_output=True, text=True, check=False)
|
||||
self.assertEqual(branch_check.returncode, 0, "Preexisting branch was deleted by mistake!")
|
||||
|
||||
def test_incompatible_idempotency_replay_refusal(self):
|
||||
"""Review #525 Finding 4: Replaying key with incompatible parameters returns refusal."""
|
||||
key = "test_key_incompatible_replay"
|
||||
res1 = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
branch_name="fix/issue-850-param-a",
|
||||
idempotency_key=key,
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
self.assertTrue(res1["success"])
|
||||
|
||||
# Second call with different branch_name
|
||||
res2 = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
branch_name="fix/issue-850-param-b",
|
||||
idempotency_key=key,
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
self.assertFalse(res2["success"])
|
||||
self.assertEqual(res2.get("reason_code"), "incompatible_idempotency_replay")
|
||||
|
||||
def test_exact_next_action_satisfiable_via_mcp(self):
|
||||
"""Review #525 Finding 4: exact_next_action provides satisfiable MCP actions, not shell commands."""
|
||||
key = "test_key_next_action_mcp"
|
||||
stale_sha = "0000000000000000000000000000000000000000"
|
||||
res = author_issue_bootstrap.bootstrap_author_issue_worktree(
|
||||
issue_number=850,
|
||||
canonical_repo_root=self.repo_dir,
|
||||
expected_base_sha=stale_sha,
|
||||
lock_dir=self.lock_dir,
|
||||
)
|
||||
next_action = res.get("exact_next_action", "")
|
||||
self.assertNotIn("scripts/worktree-start", next_action)
|
||||
self.assertNotIn("git worktree add", next_action)
|
||||
self.assertNotIn("bash", next_action.lower())
|
||||
|
||||
def test_task_capability_map_integration(self):
|
||||
"""Verify task_capability_map has bootstrap_author_issue_worktree configured correctly."""
|
||||
self.assertEqual(task_capability_map.required_role("bootstrap_author_issue_worktree"), "author")
|
||||
self.assertEqual(task_capability_map.required_permission("bootstrap_author_issue_worktree"), "gitea.branch.create")
|
||||
self.assertTrue(task_capability_map.preflight_task_matches("work_issue", "bootstrap_author_issue_worktree"))
|
||||
self.assertTrue(task_capability_map.preflight_task_matches("bootstrap_author_issue_worktree", "lock_issue"))
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -28,21 +28,6 @@ class TestPathUnderBranches(unittest.TestCase):
|
||||
amw.is_path_under_branches("/repo/other-checkout", self.ROOT)
|
||||
)
|
||||
|
||||
def test_unrelated_branches_dir_fails(self):
|
||||
self.assertFalse(
|
||||
amw.is_path_under_branches("/tmp/branches/evil", self.ROOT)
|
||||
)
|
||||
|
||||
def test_prefix_confusion_fails(self):
|
||||
self.assertFalse(
|
||||
amw.is_path_under_branches(f"{self.ROOT}/branches-other/foo", self.ROOT)
|
||||
)
|
||||
|
||||
def test_traversal_fails(self):
|
||||
self.assertFalse(
|
||||
amw.is_path_under_branches(f"{self.ROOT}/branches/../evil", self.ROOT)
|
||||
)
|
||||
|
||||
|
||||
class TestAssessAuthorMutationWorktree(unittest.TestCase):
|
||||
ROOT = "/repo/Gitea-Tools"
|
||||
|
||||
@@ -139,8 +139,6 @@ EXPECTED_ROLE_EXCLUSIVE_TASKS = frozenset(
|
||||
"gitea_release_merger_pr_lease",
|
||||
"create_branch",
|
||||
"push_branch",
|
||||
"bootstrap_author_issue_worktree",
|
||||
"gitea_bootstrap_author_issue_worktree",
|
||||
# #812 AC20: publishing an unpublished local head is author-only for the
|
||||
# same reason every other push is — it writes a branch to the remote.
|
||||
"publish_unpublished_branch",
|
||||
|
||||
@@ -0,0 +1,222 @@
|
||||
"""Tests for the read-only workflow policy/guardrail visibility view (#646).
|
||||
|
||||
Covers issue #646 acceptance criteria:
|
||||
|
||||
1. Console lists major guardrails with source pointers.
|
||||
2. Secrets redacted.
|
||||
3. Tests ensure sample secrets never appear.
|
||||
4. Docs explain read-only nature (asserted here for the page copy; the doc
|
||||
itself is covered by inspection).
|
||||
"""
|
||||
|
||||
import json
|
||||
import sys
|
||||
import unittest
|
||||
from pathlib import Path
|
||||
|
||||
sys.path.insert(0, str(Path(__file__).resolve().parent.parent))
|
||||
|
||||
from starlette.testclient import TestClient
|
||||
|
||||
from webui import console_redaction
|
||||
from webui import policy_inventory
|
||||
from webui.app import create_app
|
||||
from webui.policy_inventory import (
|
||||
PolicyEntry,
|
||||
PolicyInventorySnapshot,
|
||||
SourcePointer,
|
||||
load_policy_inventory,
|
||||
snapshot_to_dict,
|
||||
)
|
||||
from webui.policy_views import render_policy_page
|
||||
|
||||
|
||||
def _entry(key, category, *, active=None, error=None):
|
||||
return PolicyEntry(
|
||||
key=key,
|
||||
title=key.replace("_", " ").title(),
|
||||
category=category,
|
||||
summary=f"summary for {key}",
|
||||
sources=(SourcePointer("src", f"{key}.py", "module"),),
|
||||
active=active,
|
||||
documented_default=None,
|
||||
diff=None,
|
||||
error=error,
|
||||
)
|
||||
|
||||
|
||||
def _snapshot(entries):
|
||||
return PolicyInventorySnapshot(
|
||||
schema_version=1,
|
||||
read_only=True,
|
||||
note="read-only projection",
|
||||
entries=tuple(entries),
|
||||
categories=tuple(dict.fromkeys(e.category for e in entries)),
|
||||
build_errors=(),
|
||||
)
|
||||
|
||||
# The guardrail categories issue #646 names as in-scope.
|
||||
_EXPECTED_CATEGORIES = {
|
||||
"role_separation",
|
||||
"lease_rules",
|
||||
"worktree_rules",
|
||||
"merge_confirmation",
|
||||
"redaction",
|
||||
"contamination",
|
||||
"allocator_policy",
|
||||
"audit_logging",
|
||||
"mutation_gating",
|
||||
}
|
||||
|
||||
|
||||
class TestPolicyInventoryModel(unittest.TestCase):
|
||||
def test_major_guardrails_present(self):
|
||||
snapshot = load_policy_inventory()
|
||||
categories = {e.category for e in snapshot.entries}
|
||||
self.assertEqual(_EXPECTED_CATEGORIES, categories)
|
||||
self.assertGreaterEqual(len(snapshot.entries), len(_EXPECTED_CATEGORIES))
|
||||
|
||||
def test_every_guardrail_has_source_pointers(self):
|
||||
# AC1: source attribution (file/module/doc) for every guardrail.
|
||||
snapshot = load_policy_inventory()
|
||||
for entry in snapshot.entries:
|
||||
with self.subTest(entry=entry.key):
|
||||
self.assertTrue(entry.sources, "guardrail must carry source pointers")
|
||||
for source in entry.sources:
|
||||
self.assertTrue(source.path)
|
||||
self.assertIn(source.kind, {"module", "doc", "script", "config"})
|
||||
|
||||
def test_diff_reported_where_documented_default_declared(self):
|
||||
snapshot = load_policy_inventory()
|
||||
checked_any = False
|
||||
for entry in snapshot.entries:
|
||||
if entry.documented_default is None:
|
||||
self.assertIsNone(entry.diff)
|
||||
continue
|
||||
checked_any = True
|
||||
self.assertIsNotNone(entry.diff)
|
||||
self.assertEqual(
|
||||
entry.diff["status"],
|
||||
"matches_documented_default",
|
||||
f"{entry.key} drifted from its documented default: {entry.diff}",
|
||||
)
|
||||
self.assertTrue(checked_any, "at least one guardrail should declare a default")
|
||||
|
||||
def test_live_projections_populate_active(self):
|
||||
snapshot = load_policy_inventory()
|
||||
by_key = {e.key: e for e in snapshot.entries}
|
||||
for key in ("role_separation", "redaction", "audit_logging"):
|
||||
self.assertIsNone(by_key[key].error, f"{key} projection failed")
|
||||
self.assertIsInstance(by_key[key].active, dict)
|
||||
|
||||
def test_build_entry_is_fail_soft_on_projection_error(self):
|
||||
def _boom():
|
||||
raise RuntimeError("projection exploded")
|
||||
|
||||
row = (
|
||||
"redaction",
|
||||
"Secret redaction",
|
||||
"redaction",
|
||||
"summary",
|
||||
(SourcePointer("x", "webui/console_redaction.py", "module"),),
|
||||
_boom,
|
||||
{"redact_before_persist": True},
|
||||
)
|
||||
entry = policy_inventory._build_entry(row)
|
||||
self.assertIsNone(entry.active)
|
||||
self.assertIsNotNone(entry.error)
|
||||
self.assertEqual(entry.diff["status"], "active_unavailable")
|
||||
|
||||
|
||||
class TestPolicyRedaction(unittest.TestCase):
|
||||
def test_real_snapshot_has_no_secret_shapes(self):
|
||||
# AC3: the real emitted payload never carries a known secret shape.
|
||||
payload = snapshot_to_dict(load_policy_inventory())
|
||||
self.assertEqual(console_redaction.scan_for_secrets(payload), [])
|
||||
|
||||
def test_planted_keychain_secret_is_redacted(self):
|
||||
# AC2/AC3: a secret planted in an active projection is masked before emit.
|
||||
snapshot = _snapshot([
|
||||
_entry(
|
||||
"redaction",
|
||||
"redaction",
|
||||
active={"leaked": "keychain:prgs-author-super-secret", "roles": ["author"]},
|
||||
)
|
||||
])
|
||||
payload = snapshot_to_dict(snapshot)
|
||||
blob = json.dumps(payload)
|
||||
self.assertNotIn("keychain:prgs-author-super-secret", blob)
|
||||
self.assertEqual(console_redaction.scan_for_secrets(payload), [])
|
||||
|
||||
def test_planted_credential_assignment_is_redacted(self):
|
||||
snapshot = _snapshot([
|
||||
_entry(
|
||||
"audit_logging",
|
||||
"audit_logging",
|
||||
active={"leaked": "token=abcd1234efgh5678", "append_only": True},
|
||||
)
|
||||
])
|
||||
payload = snapshot_to_dict(snapshot)
|
||||
blob = json.dumps(payload)
|
||||
self.assertNotIn("abcd1234efgh5678", blob)
|
||||
self.assertEqual(console_redaction.scan_for_secrets(payload), [])
|
||||
|
||||
|
||||
class TestPolicyRoutes(unittest.TestCase):
|
||||
def setUp(self):
|
||||
self.client = TestClient(create_app())
|
||||
|
||||
def test_policy_html_lists_guardrails_with_sources(self):
|
||||
response = self.client.get("/policy")
|
||||
self.assertEqual(response.status_code, 200)
|
||||
text = response.text
|
||||
self.assertIn("Workflow policy", text)
|
||||
self.assertIn("Role separation and RBAC", text)
|
||||
self.assertIn("Source pointers", text)
|
||||
self.assertIn("task_capability_map.py", text)
|
||||
self.assertIn("docs/safety-model.md", text)
|
||||
|
||||
def test_policy_html_states_read_only(self):
|
||||
# AC4: the page explains its read-only nature.
|
||||
text = self.client.get("/policy").text
|
||||
self.assertIn("read-only", text.lower())
|
||||
self.assertNotIn("<form", text.lower())
|
||||
|
||||
def test_policy_html_has_no_secret_shapes(self):
|
||||
text = self.client.get("/policy").text
|
||||
self.assertEqual(console_redaction.scan_for_secrets(text), [])
|
||||
|
||||
def test_api_v1_policy_returns_inventory(self):
|
||||
response = self.client.get("/api/v1/policy")
|
||||
self.assertEqual(response.status_code, 200)
|
||||
data = response.json()
|
||||
self.assertEqual(data["schema_version"], policy_inventory.SCHEMA_VERSION)
|
||||
self.assertTrue(data["read_only"])
|
||||
self.assertEqual(data["entry_count"], len(data["entries"]))
|
||||
self.assertEqual(set(data["categories"]), _EXPECTED_CATEGORIES)
|
||||
|
||||
def test_policy_is_read_only_no_post(self):
|
||||
# AC4 / non-goal: no mutation endpoint.
|
||||
response = self.client.post("/policy")
|
||||
self.assertIn(response.status_code, (404, 405))
|
||||
|
||||
def test_nav_links_policy(self):
|
||||
text = self.client.get("/").text
|
||||
self.assertIn('href="/policy"', text)
|
||||
|
||||
|
||||
class TestPolicyViewFailSoft(unittest.TestCase):
|
||||
def test_page_renders_when_a_projection_errors(self):
|
||||
snapshot = _snapshot([
|
||||
_entry("role_separation", "role_separation", error="active projection unavailable: boom"),
|
||||
_entry("redaction", "redaction", active={"redact_before_persist": True}),
|
||||
])
|
||||
page = render_policy_page(snapshot)
|
||||
# The errored guardrail surfaces its error; other guardrails still render.
|
||||
self.assertIn("Active value unavailable", page)
|
||||
self.assertIn("Redaction", page)
|
||||
self.assertIn("Workflow policy", page)
|
||||
|
||||
|
||||
if __name__ == "__main__":
|
||||
unittest.main()
|
||||
@@ -45,6 +45,8 @@ from webui.worktree_scanner import load_hygiene_snapshot, snapshot_to_dict as wo
|
||||
from webui.worktree_views import render_worktrees_page
|
||||
from webui.runtime_health import load_runtime_snapshot, snapshot_to_dict as runtime_snapshot_to_dict
|
||||
from webui.runtime_views import render_runtime_page
|
||||
from webui.policy_inventory import load_policy_inventory, snapshot_to_dict as policy_snapshot_to_dict
|
||||
from webui.policy_views import render_policy_page
|
||||
from webui.system_health import (
|
||||
API_PATH as SYSTEM_HEALTH_API_PATH,
|
||||
load_system_health,
|
||||
@@ -74,6 +76,7 @@ async def home(_request: Request) -> HTMLResponse:
|
||||
"<li><strong>Projects</strong> — registry and onboarding (#427)</li>"
|
||||
"<li><strong>Prompts</strong> — canonical workflow prompt library (#428)</li>"
|
||||
"<li><strong>Runtime</strong> — MCP health and stale-runtime detection (#430)</li>"
|
||||
"<li><strong>Policy</strong> — workflow guardrail configuration visibility (#646)</li>"
|
||||
"<li><strong>Audit</strong> — final-report paste and validator preview (#431)</li>"
|
||||
"<li><strong>Worktrees</strong> — branch hygiene dashboard (#432)</li>"
|
||||
"<li><strong>Leases</strong> — collision and lease visibility (#433)</li>"
|
||||
@@ -243,6 +246,17 @@ async def api_runtime(_request: Request) -> JSONResponse:
|
||||
return JSONResponse(runtime_snapshot_to_dict(load_runtime_snapshot()))
|
||||
|
||||
|
||||
async def policy(_request: Request) -> HTMLResponse:
|
||||
snapshot = load_policy_inventory()
|
||||
return HTMLResponse(
|
||||
render_page(title="Policy", body_html=render_policy_page(snapshot))
|
||||
)
|
||||
|
||||
|
||||
async def api_v1_policy(_request: Request) -> JSONResponse:
|
||||
return JSONResponse(policy_snapshot_to_dict(load_policy_inventory()))
|
||||
|
||||
|
||||
async def _parse_audit_form(request: Request) -> tuple[str, str | None]:
|
||||
if request.method == "GET":
|
||||
return "", None
|
||||
@@ -449,6 +463,8 @@ def create_app(*, bind_host: str | None = None) -> Starlette:
|
||||
Route("/api/prompts", api_prompts, methods=["GET"]),
|
||||
Route("/runtime", runtime, methods=["GET"]),
|
||||
Route("/api/runtime", api_runtime, methods=["GET"]),
|
||||
Route("/policy", policy, methods=["GET"]),
|
||||
Route("/api/v1/policy", api_v1_policy, methods=["GET"]),
|
||||
Route("/audit", audit, methods=["GET", "POST"]),
|
||||
Route("/api/audit", api_audit, methods=["GET", "POST"]),
|
||||
Route("/worktrees", worktrees, methods=["GET"]),
|
||||
|
||||
@@ -8,6 +8,7 @@ NAV_ITEMS = (
|
||||
("/projects", "Projects"),
|
||||
("/prompts", "Prompts"),
|
||||
("/runtime", "Runtime"),
|
||||
("/policy", "Policy"),
|
||||
("/audit", "Audit"),
|
||||
("/worktrees", "Worktrees"),
|
||||
("/leases", "Leases"),
|
||||
|
||||
@@ -0,0 +1,387 @@
|
||||
"""Read-only workflow policy and guardrail inventory for the web UI (#646).
|
||||
|
||||
Policy and guardrails live in code, profiles, docs, and skills. An operator
|
||||
cannot *see* the active workflow policy configuration from the console without
|
||||
reading the repository tree. This module projects the major guardrails into a
|
||||
redacted, machine-readable inventory with source attribution (file / module /
|
||||
doc), so the console can render them as HTML tables with source pointers.
|
||||
|
||||
Design constraints (Phase 3, #646):
|
||||
|
||||
- **Read-only projection.** Nothing here edits policy or exposes a toggle that
|
||||
could weaken a gate. It reports what is already enforced elsewhere.
|
||||
- **Source attribution without secrets.** Every guardrail carries pointers to
|
||||
the file/module/doc that owns it. Live values are compact summaries derived
|
||||
from the safe policy accessors that already exist (``rbac_matrix``,
|
||||
``redaction_policy``, ``audit_policy``); raw regex, tokens, and endpoints are
|
||||
never embedded.
|
||||
- **Redact before emit.** ``snapshot_to_dict`` runs the whole payload through
|
||||
``console_redaction.redact_payload`` so a planted or accidental secret in any
|
||||
projected value degrades to the placeholder rather than reaching a client.
|
||||
- **Fail soft.** A projection that raises is recorded as a per-entry error and
|
||||
never takes the page down; a guardrail is still listed with its sources.
|
||||
- **Diff vs documented defaults where feasible.** When a guardrail declares a
|
||||
documented invariant, the active projection is compared against it and the
|
||||
result is reported; otherwise the diff is explicitly ``None`` with a reason.
|
||||
"""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
from dataclasses import dataclass
|
||||
from typing import Any, Callable
|
||||
|
||||
from webui import console_audit
|
||||
from webui import console_authz
|
||||
from webui import console_redaction
|
||||
|
||||
SCHEMA_VERSION = 1
|
||||
|
||||
READ_ONLY_NOTE = (
|
||||
"Read-only projection of guardrails enforced in code, profiles, docs, and "
|
||||
"skills. This view never edits policy and exposes no gate-weakening toggle."
|
||||
)
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class SourcePointer:
|
||||
"""Where a guardrail is defined. Attribution only — never a secret."""
|
||||
|
||||
label: str
|
||||
path: str
|
||||
kind: str # "module" | "doc" | "script" | "config"
|
||||
anchor: str | None = None
|
||||
|
||||
def to_dict(self) -> dict[str, Any]:
|
||||
return {
|
||||
"label": self.label,
|
||||
"path": self.path,
|
||||
"kind": self.kind,
|
||||
"anchor": self.anchor,
|
||||
}
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class PolicyEntry:
|
||||
key: str
|
||||
title: str
|
||||
category: str
|
||||
summary: str
|
||||
sources: tuple[SourcePointer, ...]
|
||||
active: dict[str, Any] | None
|
||||
documented_default: dict[str, Any] | None
|
||||
diff: dict[str, Any] | None
|
||||
error: str | None = None
|
||||
|
||||
def to_dict(self) -> dict[str, Any]:
|
||||
return {
|
||||
"key": self.key,
|
||||
"title": self.title,
|
||||
"category": self.category,
|
||||
"summary": self.summary,
|
||||
"sources": [s.to_dict() for s in self.sources],
|
||||
"active": self.active,
|
||||
"documented_default": self.documented_default,
|
||||
"diff": self.diff,
|
||||
"error": self.error,
|
||||
}
|
||||
|
||||
|
||||
@dataclass(frozen=True)
|
||||
class PolicyInventorySnapshot:
|
||||
schema_version: int
|
||||
read_only: bool
|
||||
note: str
|
||||
entries: tuple[PolicyEntry, ...]
|
||||
categories: tuple[str, ...]
|
||||
build_errors: tuple[str, ...]
|
||||
|
||||
|
||||
def _diff_active_vs_default(
|
||||
active: dict[str, Any] | None,
|
||||
documented_default: dict[str, Any] | None,
|
||||
) -> dict[str, Any] | None:
|
||||
"""Compare only the keys the documented default declares.
|
||||
|
||||
Returns ``None`` when no documented default is declared (diff not feasible)
|
||||
or when the active projection is unavailable. Otherwise reports, per
|
||||
declared key, whether the active value matches the documented invariant.
|
||||
"""
|
||||
if not documented_default:
|
||||
return None
|
||||
if not active:
|
||||
return {"status": "active_unavailable", "checked": {}}
|
||||
checked: dict[str, Any] = {}
|
||||
matches = True
|
||||
for key, expected in documented_default.items():
|
||||
observed = active.get(key)
|
||||
ok = observed == expected
|
||||
matches = matches and ok
|
||||
checked[key] = {"expected": expected, "observed": observed, "matches": ok}
|
||||
return {
|
||||
"status": "matches_documented_default" if matches else "drift_detected",
|
||||
"checked": checked,
|
||||
}
|
||||
|
||||
|
||||
# ── Live projections (compact, safe, fail-soft) ──────────────────────────────
|
||||
# Each returns a small dict of already-safe machine values. They are module
|
||||
# level so tests can substitute one to prove the redaction pass runs.
|
||||
|
||||
|
||||
def _project_role_separation() -> dict[str, Any]:
|
||||
matrix = console_authz.rbac_matrix()
|
||||
return {
|
||||
"model_version": matrix.get("model_version"),
|
||||
"active_phase": matrix.get("active_phase"),
|
||||
"roles": [r.get("role") for r in matrix.get("roles", [])],
|
||||
"privileged_action_count": len(matrix.get("privileged_actions", [])),
|
||||
"default_decision": matrix.get("default_decision"),
|
||||
"execution_enabled": matrix.get("execution_enabled"),
|
||||
}
|
||||
|
||||
|
||||
def _project_redaction() -> dict[str, Any]:
|
||||
policy = console_redaction.redaction_policy()
|
||||
return {
|
||||
"policy_version": policy.get("policy_version"),
|
||||
"placeholder": policy.get("placeholder"),
|
||||
"applies_to": policy.get("applies_to"),
|
||||
"console_detector_count": len(policy.get("console_rules", [])),
|
||||
"redact_before_persist": policy.get("redact_before_persist"),
|
||||
"failure_mode": policy.get("failure_mode"),
|
||||
}
|
||||
|
||||
|
||||
def _project_audit() -> dict[str, Any]:
|
||||
policy = console_audit.audit_policy()
|
||||
return {
|
||||
"schema_version": policy.get("schema_version"),
|
||||
"required_field_count": len(policy.get("required_fields", [])),
|
||||
"results": policy.get("results"),
|
||||
"retention_defaults_days": policy.get("retention_defaults_days"),
|
||||
"append_only": policy.get("append_only"),
|
||||
"redact_before_persist": policy.get("redact_before_persist"),
|
||||
"enabled": policy.get("enabled"),
|
||||
}
|
||||
|
||||
|
||||
def _static(value: dict[str, Any]) -> Callable[[], dict[str, Any]]:
|
||||
return lambda: dict(value)
|
||||
|
||||
|
||||
# ── Guardrail catalog ────────────────────────────────────────────────────────
|
||||
# One row per major guardrail. ``project`` yields the active value (may raise;
|
||||
# caught per entry). ``documented_default`` drives the feasible diff.
|
||||
|
||||
_CatalogRow = tuple[
|
||||
str,
|
||||
str,
|
||||
str,
|
||||
str,
|
||||
tuple[SourcePointer, ...],
|
||||
Callable[[], dict[str, Any]] | None,
|
||||
dict[str, Any] | None,
|
||||
]
|
||||
|
||||
_CATALOG: tuple[_CatalogRow, ...] = (
|
||||
(
|
||||
"role_separation",
|
||||
"Role separation and RBAC",
|
||||
"role_separation",
|
||||
"Author, reviewer, merger, and reconciler capabilities are disjoint and "
|
||||
"role-exclusive; self-review and self-merge are always blocked. The "
|
||||
"console RBAC model defaults to deny.",
|
||||
(
|
||||
SourcePointer("task capability map", "task_capability_map.py", "module"),
|
||||
SourcePointer("role/namespace gate", "role_namespace_gate.py", "module"),
|
||||
SourcePointer("console RBAC", "webui/console_authz.py", "module"),
|
||||
),
|
||||
_project_role_separation,
|
||||
{"default_decision": "deny", "execution_enabled": False},
|
||||
),
|
||||
(
|
||||
"lease_rules",
|
||||
"Issue and PR lease lifecycle",
|
||||
"lease_rules",
|
||||
"Durable work is claimed through issue locks and control-plane leases "
|
||||
"with freshness, expiry, and dead-session recovery; abandoned or stale "
|
||||
"claims are reclaimed only through the sanctioned recovery path.",
|
||||
(
|
||||
SourcePointer("issue lock store", "issue_lock_store.py", "module"),
|
||||
SourcePointer("branch cleanup guard", "branch_cleanup_guard.py", "module"),
|
||||
SourcePointer("safety model §5", "docs/safety-model.md", "doc", "5-mutation-gating"),
|
||||
),
|
||||
None,
|
||||
None,
|
||||
),
|
||||
(
|
||||
"worktree_rules",
|
||||
"Author worktree binding",
|
||||
"worktree_rules",
|
||||
"Author mutations require a validated worktree under branches/ derived "
|
||||
"from the active issue lock; silent fallback to the stable control "
|
||||
"checkout or master is forbidden (#618).",
|
||||
(
|
||||
SourcePointer("author worktree gate", "author_mutation_worktree.py", "module"),
|
||||
SourcePointer("worktree bootstrap", "scripts/worktree-start", "script"),
|
||||
SourcePointer("workflow scope guard", "workflow_scope_guard.py", "module"),
|
||||
),
|
||||
None,
|
||||
None,
|
||||
),
|
||||
(
|
||||
"merge_confirmation",
|
||||
"Explicit merge confirmation",
|
||||
"merge_confirmation",
|
||||
"A merge fails closed unless the caller passes the exact confirmation "
|
||||
"phrase for that PR; reviewing never implies merging.",
|
||||
(
|
||||
SourcePointer("merge path", "merge_pr.py", "module"),
|
||||
SourcePointer("merge tool gate", "gitea_mcp_server.py", "module"),
|
||||
),
|
||||
_static({"required_confirmation_format": "MERGE PR <n>", "auto_merge": False}),
|
||||
{"auto_merge": False},
|
||||
),
|
||||
(
|
||||
"redaction",
|
||||
"Secret redaction",
|
||||
"redaction",
|
||||
"Every console surface runs the shared gitea_audit pass then console "
|
||||
"patterns before any payload, HTML, log line, or audit record leaves "
|
||||
"the server; unredactable values fail closed to the placeholder.",
|
||||
(
|
||||
SourcePointer("console redaction", "webui/console_redaction.py", "module"),
|
||||
SourcePointer("shared redaction", "gitea_audit.py", "module"),
|
||||
SourcePointer("safety model §3", "docs/safety-model.md", "doc", "3-secret-redaction"),
|
||||
),
|
||||
_project_redaction,
|
||||
{"redact_before_persist": True},
|
||||
),
|
||||
(
|
||||
"contamination",
|
||||
"Contamination containment",
|
||||
"contamination",
|
||||
"A session contaminated by a direct stable-branch push or a manual MCP "
|
||||
"daemon kill is blocked from review, merge, close, and completion "
|
||||
"mutations until cleared (reconciler-exempt).",
|
||||
(
|
||||
SourcePointer("contamination gates", "gitea_mcp_server.py", "module"),
|
||||
SourcePointer("stable-branch audit", "workflow_scope_guard.py", "module"),
|
||||
),
|
||||
None,
|
||||
None,
|
||||
),
|
||||
(
|
||||
"allocator_policy",
|
||||
"Work allocation policy",
|
||||
"allocator_policy",
|
||||
"Workers do not self-select exclusive work; the controller-owned "
|
||||
"allocator ranks the complete queue by priority then PRs-before-issues "
|
||||
"then ascending number, honoring dependency edges and foreign claims.",
|
||||
(
|
||||
SourcePointer("allocator", "gitea_mcp_server.py", "module"),
|
||||
SourcePointer("safety model §5", "docs/safety-model.md", "doc", "5-mutation-gating"),
|
||||
),
|
||||
_static(
|
||||
{
|
||||
"self_select_exclusive_work": False,
|
||||
"ranking": "priority desc, PRs before issues, number asc",
|
||||
"respects_dependency_edges": True,
|
||||
"respects_foreign_claims": True,
|
||||
}
|
||||
),
|
||||
{"self_select_exclusive_work": False},
|
||||
),
|
||||
(
|
||||
"audit_logging",
|
||||
"Audit logging",
|
||||
"audit_logging",
|
||||
"Console intent and authorization outcomes are recorded to an "
|
||||
"append-only, redact-before-persist audit log; MCP mutations are "
|
||||
"recorded by gitea_audit and correlated by request id.",
|
||||
(
|
||||
SourcePointer("console audit", "webui/console_audit.py", "module"),
|
||||
SourcePointer("MCP audit", "gitea_audit.py", "module"),
|
||||
SourcePointer("safety model §1", "docs/safety-model.md", "doc", "1-audit-logging-and-confirmation"),
|
||||
),
|
||||
_project_audit,
|
||||
{"append_only": True, "redact_before_persist": True},
|
||||
),
|
||||
(
|
||||
"mutation_gating",
|
||||
"Mutation gating and master parity",
|
||||
"mutation_gating",
|
||||
"Mutations fail closed while the running server is stale relative to "
|
||||
"master, and every mutation is preceded by identity and capability "
|
||||
"resolution in a fixed pre-flight order.",
|
||||
(
|
||||
SourcePointer("mutation gate", "gitea_mcp_server.py", "module"),
|
||||
SourcePointer("safety model §5", "docs/safety-model.md", "doc", "5-mutation-gating"),
|
||||
),
|
||||
_static(
|
||||
{
|
||||
"stale_runtime_blocks_mutations": True,
|
||||
"preflight_order": "whoami -> resolve_task_capability -> mutation",
|
||||
}
|
||||
),
|
||||
{"stale_runtime_blocks_mutations": True},
|
||||
),
|
||||
)
|
||||
|
||||
|
||||
def _build_entry(row: _CatalogRow) -> PolicyEntry:
|
||||
key, title, category, summary, sources, project, documented_default = row
|
||||
active: dict[str, Any] | None = None
|
||||
error: str | None = None
|
||||
if project is not None:
|
||||
try:
|
||||
active = project()
|
||||
except Exception as exc: # noqa: BLE001 — fail soft; never take the page down
|
||||
active = None
|
||||
error = f"active projection unavailable: {exc}"
|
||||
diff = _diff_active_vs_default(active, documented_default)
|
||||
return PolicyEntry(
|
||||
key=key,
|
||||
title=title,
|
||||
category=category,
|
||||
summary=summary,
|
||||
sources=sources,
|
||||
active=active,
|
||||
documented_default=documented_default,
|
||||
diff=diff,
|
||||
error=error,
|
||||
)
|
||||
|
||||
|
||||
def load_policy_inventory() -> PolicyInventorySnapshot:
|
||||
"""Build the read-only guardrail inventory. Never raises for one bad entry."""
|
||||
entries: list[PolicyEntry] = []
|
||||
build_errors: list[str] = []
|
||||
for row in _CATALOG:
|
||||
try:
|
||||
entries.append(_build_entry(row))
|
||||
except Exception as exc: # noqa: BLE001 — one row must not break the rest
|
||||
build_errors.append(f"{row[0]}: {exc}")
|
||||
categories = tuple(dict.fromkeys(e.category for e in entries))
|
||||
return PolicyInventorySnapshot(
|
||||
schema_version=SCHEMA_VERSION,
|
||||
read_only=True,
|
||||
note=READ_ONLY_NOTE,
|
||||
entries=tuple(entries),
|
||||
categories=categories,
|
||||
build_errors=tuple(build_errors),
|
||||
)
|
||||
|
||||
|
||||
def snapshot_to_dict(snapshot: PolicyInventorySnapshot) -> dict[str, Any]:
|
||||
"""Serialize the snapshot, redacting the entire payload before it is emitted."""
|
||||
payload = {
|
||||
"schema_version": snapshot.schema_version,
|
||||
"read_only": snapshot.read_only,
|
||||
"note": snapshot.note,
|
||||
"categories": list(snapshot.categories),
|
||||
"entry_count": len(snapshot.entries),
|
||||
"entries": [entry.to_dict() for entry in snapshot.entries],
|
||||
"build_errors": list(snapshot.build_errors),
|
||||
}
|
||||
return console_redaction.redact_payload(payload)
|
||||
@@ -0,0 +1,104 @@
|
||||
"""HTML views for the workflow policy and guardrail inventory (#646)."""
|
||||
|
||||
from __future__ import annotations
|
||||
|
||||
import html
|
||||
import json
|
||||
|
||||
from webui.policy_inventory import PolicyEntry, PolicyInventorySnapshot
|
||||
|
||||
|
||||
def _source_pointer(source) -> str:
|
||||
path = source.path
|
||||
if source.anchor:
|
||||
path = f"{path}#{source.anchor}"
|
||||
return (
|
||||
f"<li>{html.escape(source.label)} — "
|
||||
f"<code>{html.escape(path)}</code> "
|
||||
f"<span class='muted'>({html.escape(source.kind)})</span></li>"
|
||||
)
|
||||
|
||||
|
||||
def _active_block(entry: PolicyEntry) -> str:
|
||||
if entry.error:
|
||||
return (
|
||||
"<p class='muted'><strong>Active value unavailable:</strong> "
|
||||
f"{html.escape(entry.error)}</p>"
|
||||
)
|
||||
if not entry.active:
|
||||
return "<p class='muted'>No live projection for this guardrail.</p>"
|
||||
pretty = json.dumps(entry.active, indent=2, sort_keys=True, default=str)
|
||||
return f"<pre class='prompt-text'>{html.escape(pretty)}</pre>"
|
||||
|
||||
|
||||
def _diff_block(entry: PolicyEntry) -> str:
|
||||
if entry.diff is None:
|
||||
if entry.documented_default is None:
|
||||
return "<p class='muted'>Diff vs documented default: not feasible (no declared default).</p>"
|
||||
return "<p class='muted'>Diff vs documented default: unavailable.</p>"
|
||||
status = entry.diff.get("status", "unknown")
|
||||
badge = "badge-claimed" if status == "matches_documented_default" else "badge-blocked"
|
||||
rows = []
|
||||
for key, cell in (entry.diff.get("checked") or {}).items():
|
||||
marker = "✓" if cell.get("matches") else "✗"
|
||||
rows.append(
|
||||
"<tr>"
|
||||
f"<td><code>{html.escape(str(key))}</code></td>"
|
||||
f"<td><code>{html.escape(str(cell.get('expected')))}</code></td>"
|
||||
f"<td><code>{html.escape(str(cell.get('observed')))}</code></td>"
|
||||
f"<td>{marker}</td>"
|
||||
"</tr>"
|
||||
)
|
||||
table = ""
|
||||
if rows:
|
||||
table = (
|
||||
"<table class='detail'><thead><tr>"
|
||||
"<th>Key</th><th>Documented</th><th>Active</th><th>Match</th>"
|
||||
"</tr></thead><tbody>"
|
||||
f"{''.join(rows)}</tbody></table>"
|
||||
)
|
||||
return (
|
||||
f"<p class='meta'>Diff vs documented default: "
|
||||
f"<span class='badge {badge}'>{html.escape(status)}</span></p>"
|
||||
f"{table}"
|
||||
)
|
||||
|
||||
|
||||
def _entry_card(entry: PolicyEntry) -> str:
|
||||
sources = "".join(_source_pointer(s) for s in entry.sources)
|
||||
return (
|
||||
"<div class='prompt-card'>"
|
||||
f"<h3>{html.escape(entry.title)} "
|
||||
f"<span class='badge'>{html.escape(entry.category)}</span></h3>"
|
||||
f"<p>{html.escape(entry.summary)}</p>"
|
||||
"<p class='meta'><strong>Source pointers</strong></p>"
|
||||
f"<ul>{sources}</ul>"
|
||||
"<p class='meta'><strong>Active configuration</strong></p>"
|
||||
f"{_active_block(entry)}"
|
||||
f"{_diff_block(entry)}"
|
||||
"</div>"
|
||||
)
|
||||
|
||||
|
||||
def render_policy_page(snapshot: PolicyInventorySnapshot) -> str:
|
||||
categories = ", ".join(html.escape(c) for c in snapshot.categories) or "none"
|
||||
cards = "".join(_entry_card(e) for e in snapshot.entries)
|
||||
build_errors = ""
|
||||
if snapshot.build_errors:
|
||||
items = "".join(
|
||||
f"<li>{html.escape(err)}</li>" for err in snapshot.build_errors
|
||||
)
|
||||
build_errors = (
|
||||
"<div class='stub'><p><strong>Some guardrails could not be built:"
|
||||
f"</strong></p><ul>{items}</ul></div>"
|
||||
)
|
||||
return (
|
||||
"<h2>Workflow policy & guardrails</h2>"
|
||||
f"<p class='muted'>{html.escape(snapshot.note)}</p>"
|
||||
f"<p class='meta'>Schema v{snapshot.schema_version} · "
|
||||
f"{len(snapshot.entries)} guardrails · categories: {categories}</p>"
|
||||
f"{build_errors}"
|
||||
f"{cards}"
|
||||
"<p class='muted'>This page is read-only. It reports enforced policy "
|
||||
"and never edits or weakens a gate. Secret values are redacted.</p>"
|
||||
)
|
||||
Reference in New Issue
Block a user